Hacker News Reader

Comment by kefka | Hacker News Reader

And CloudFlare is destroying user's abilities to use TOR in any meaningful way.

What we get when we hit a CloudFlare backed page: CAPTCHA, after CAPTCHA, after CAPTCHA. And not only that, but it's Google's reCaptcha, which many of them are nigh unsolvable.

Worse yet, if we leave any sort of comments, we get served another CAPTCHA, which destroys the comment we tried to make. Their failing systems end up silencing us.

We want you to lessen up on serving CAPTCHAs on everything: respond when you see real abuse from that TCP session, and not 'just because we're TOR users'.

View on HN

When I use VPN and hit CloudFlare I get the easy "I'm a human" captcha that tracks mouse movement and timing. Are you seeing different?

I wish it were that easy.

When on TOR, the "() I am A Human" doesn't show up. Instead, you get the reCAPTCHA 2 jibberish words. Unfortunately, many of what you're given aren't readable at all.

Now, you get that CAPTCHA every page you load that uses Cloudflare. And it's just terrible. They're breaking the 'Net for TOR users.

1. You may not have Javascript enabled.

2. Doesn't the captcha unlock you for the whole browsing session?

3. Cloudflare is working as intended. They could just block Tor outright. I think this is probably the best compromise.

1. I've tried JS on and off, in Tor Browser, and in a proxied stock firefox.

2. No. It's a crapshoot. Sometimes it does, but about >75% of the time, it goes into CAPTCHA loops.

3. There's plenty of things that could be done to alleviate this issue :

One, they could set up their own .onion service, and redirect TOR users to it. And that would rate-limit any potential TOR-user based damage.

Two, since sessions are per TCP, just slow the TCP down accordingly. That's standard practice for things like tarpits and the like.

Three, there's no need for CAPTCHAs on a HTTP GET, if not done in a harassing manner. But this basis is on being in a "Bad IP list". POSTs are a whole different story.

1. Disabling javascript while using Tor is probably a good idea, because it removes a lot of potential risks from the equation. risk vs convenience I guess.

2. In theory yes, in practice that doesn't seem to be the case, with people reporting captcha-loops etc. And everything that allows CF to reliably reidentify the user is at the same time a potential vulnerability of the user.

3. Or they could implement less drastic measures and still protect their customers (e.g. what risk does a GET request against a cached site really pose that requires a captcha?).

It's a sliding scale and not obvious what the "best" solution is. There are good arguments in both directions, and Cloudflare is important enough that they IMHO should think further than "what's easiest for us". They seem at least to be somewhat receptive towards arguments about this.

*Tor

Reply on news.ycombinator.com